Langflow CVE-2026-6596

No special conditions-remote unauthenticated exploitation against default configurations of Langflow API v1 up to version 1.1.0. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-based attack requiring no authentication, low complexity, and no user interaction. Exploitation is limited only by network accessibility to the Langflow API endpoint (/api/v1/endpoints.py routes). Organizations that have deployed Langflow with API endpoints exposed to the internet, internal networks, or cloud environments without additional authentication layers (OAuth, API keys, VPN) are immediately vulnerable. No specific Langflow configuration setting, feature toggle, or deployment mode is required-the vulnerability exists in default API endpoint behavior.

Real-world risk is HIGH despite the 7.3 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable with no authentication, low complexity, and no user interaction-the most dangerous attack surface. The E:P (Proof-of-concept Exploit) temporal metric and confirmed public exploit code on GitHub GIST significantly lower the barrier to exploitation. SSVC factors indicate high priority: exploitation status is POC-available (one step below active exploitation), automatable (AV:N/PR:N suggests scriptable attack), and technical impact spans confidentiality/integrity/availability (C:L/I:L/A:L-likely underestimated given file upload typically enables full compromise). Vendor non-responsiveness is a critical red flag-no patch timeline, no workaround guidance, no acknowledgment. For organizations running Langflow in production or accessible environments, this is an immediate patching/mitigation priority. The 'low' CIA impact ratings may reflect theoretical modeling, but practical unrestricted upload attacks routinely achieve full system compromise via web shell deployment or code execution.

An unauthenticated remote attacker sends a crafted HTTP POST request to the Langflow API endpoint (e.g., https://target.com/api/v1/create_upload_file) containing a malicious Python file disguised with a benign filename or MIME type. The create_upload_file function accepts and stores the file in a web-accessible or executable directory without validating content or extension. The attacker then triggers execution by either accessing the uploaded file via HTTP (if stored in webroot) or invoking it through Langflow's workflow execution features, achieving remote code execution as the application user. Public POC code exists demonstrating this attack chain.